Executive brief
The ActivityPub client in Ghost, a popular open-source publishing platform, is vulnerable to a security flaw that allows malicious actors to inject unauthorized JavaScript code. This occurs when a Ghost site interacts with a compromised or malicious ActivityPub server, potentially leading to the theft of user session data or unauthorized actions on behalf of site visitors. Organizations using Ghost's social networking features should update their installations to prevent potential account takeovers or site defacement.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the @tryghost/activitypub package due to improper neutralization of input during web page generation (CWE-79). The vulnerability is triggered when the Ghost ActivityPub client processes and renders posts from a malicious ActivityPub server. An attacker can achieve remote code execution in the context of the victim's browser, potentially leading to session hijacking or data exfiltration. The attack requires a high complexity as it involves a customized malicious server and user interaction to view the affected content. The issue is resolved in version 3.1.0 of the package.
Affected products
- Ghost @tryghost/activitypub < 3.1.0
Timeline
- 2026-06-10: disclosed: Disclosed by Brad Geesaman
- 2026-06-24: advisory: NVD publication date
- 2026-08-04: patched: GitHub Advisory published and reviewed